Free, no-auth ransomware leak-site intelligence from ThreatCluster: victims, groups, and the onion infrastructure behind them — snapshotted here daily so the git history is a timestamped record.
TLP:CLEAR — free to use, redistribute, and integrate. Attribution appreciated.
Last updated: 2026-10-31 12:59 UTC
| Ransomware groups tracked | 156 |
| Victims, last 90 days | 3,233 |
| Victims, last 365 days | 9,862 |
| Victims read first-hand from leak sites | 1,823 |
| Onion addresses catalogued | 668 (2 confirmed up at last probe) |
| Known data breaches | 0 |
Most public ransomware-victim datasets on GitHub stopped updating years ago, and the ones still
alive republish the same aggregator rows as each other. This one is different in one specific way:
a growing share of it is read directly off the leak sites by our own crawler, not imported
from an aggregator. Those rows are marked first_party=yes and have no equivalent elsewhere.
What this repo holds is the listing: who was named, by which group, when, and whether the post is still up. What our crawler extracts from each post (claimed data size, file counts, publication and negotiation state, the ransom figure, the victim's legal name and headquarters, our own summary and screenshot) is the enriched record, and that lives in the API rather than in these files. See Enriched records below.
Everything is the group's claim, not a confirmed breach. Treat it as such.
Refreshed daily from the API. Use these for a pinned, versioned copy — or git log -p to see when
a victim first appeared, when a post was delisted, or when a leak site went dark.
| File | Contents |
|---|---|
data/victims.csv |
Victims listed in the last 90 days |
data/victims-365d.csv |
Victims listed in the last 365 days |
data/victims-firstparty.csv |
Only the rows we read off the leak site ourselves (365 days) |
data/victims.json |
Last 30 days as JSON, same fields as the CSV (plus website where known) |
data/groups.csv |
Every extortion group tracked: activity window, claimed-victim count, how many we verified first-hand, mirrors currently up |
data/onions.csv |
Leak-site and underground .onion addresses, with our own up/down probe result |
# pin to this repo
curl -s https://raw.githubusercontent.com/Jam0k/Ransomware-Intel/main/data/victims.csvThe live API below is always current; these files lag by up to a day.
# Victims, last 90 days (CSV)
curl https://threatcluster.io/api/darkweb/public/victims.csv
# Same, full year
curl "https://threatcluster.io/api/darkweb/public/victims.csv?days=365"
# Same, JSON, 30 days
curl https://threatcluster.io/api/darkweb/public/victims.json
# Groups and onion infrastructure
curl https://threatcluster.io/api/darkweb/public/groups.csv
curl https://threatcluster.io/api/darkweb/public/onions.csv
# Headline counts
curl https://threatcluster.io/api/darkweb/statsAll endpoints are unauthenticated and rate-limited to 60 requests/minute.
victims.csv — ?days= caps the window (default 90, max 365).
| Column | Meaning |
|---|---|
group |
Extortion group that listed the victim |
victim |
Organisation name as the group wrote it |
country, sector |
Where known; blank means unknown, never guessed |
discovered |
Date the listing was first seen |
post_url |
The leak-site post |
status |
listed or delisted — see below |
delisted_date |
When the post stopped being reachable |
first_party |
yes if the row was read off the leak site by ThreatCluster; no if imported from an aggregator |
victims.json carries the same columns, plus website where the leak page states it.
Everything our crawler extracts from the post itself is in the API, one call per victim:
curl -H "X-API-Key: $TC_KEY" \
"https://threatcluster.io/api/public/v1/darkweb/ransomware/victim/{id}"That record carries the claimed data size and file count, publication and negotiation state
(listed · countdown · published · negotiating · sold, normalised from the site's own
wording), the ransom figure, the .onion page it was read from, the victim's legal name,
headquarters, revenue and employee count, extracted data categories, our screenshot, and a short
summary generated only from what we collected. It costs 10 credits; a free key is minted on every
account with 100 credits a day, no card. /api/public/v1/darkweb/ransomware/victims lists victims
with the same filters as the CSV. Quick start: https://threatcluster.io/api
status=delisted means the post is no longer reachable on the leak site. It is an
observation, not a claim that a ransom was paid — groups remove posts for their own reasons.
first_party=yes is the point of this dataset. Our crawler fetched the group's index, then
each victim's own page, and extracted the fields from what the site actually says. Where a
first-party value and an aggregator value both exist, the first-party one wins.
Every active group, linked to its ThreatCluster page (leak-site status, mirrors, claimed victims, our own screenshot). Regenerated daily.
156 active groups; top 150 by claimed victims.
| Group | Claimed victims | Read first-hand | Last seen |
|---|---|---|---|
| qilin | 2,544 | 220 | 2026-10-17 |
| lockbit3 | 2,016 | 71 | 2025-12-05 |
| akira | 1,658 | 0 | 2026-10-30 |
| clop | 1,303 | 139 | 2026-09-10 |
| incransom | 980 | 77 | 2026-10-15 |
| dragonforce | 667 | 55 | 2026-10-14 |
| safepay | 603 | 95 | 2026-10-12 |
| everest | 429 | 249 | 2026-10-17 |
| lynx | 417 | 0 | 2026-08-27 |
| lockbit5 | 392 | 183 | 2026-10-16 |
| nightspire | 362 | 24 | 2026-10-13 |
| rhysida | 311 | 0 | 2026-10-11 |
| killsec | 286 | 237 | 2026-09-18 |
| ransomhouse | 214 | 0 | 2026-10-05 |
| silentransomgroup | 185 | 0 | 2026-08-27 |
| handala | 175 | 0 | 2026-04-07 |
| funksec | 172 | 0 | 2025-03-18 |
| krybit | 168 | 222 | 2026-10-04 |
| n0n | 167 | 91 | |
| shinyhunters | 161 | 0 | 2026-09-24 |
| spacebears | 160 | 54 | 2026-10-15 |
| apt73 | 157 | 269 | 2026-07-24 |
| interlock | 140 | 57 | 2026-10-12 |
| genesis | 131 | 27 | 2026-09-30 |
| pear | 131 | 43 | 2026-10-14 |
| arcusmedia | 118 | 84 | 2026-10-09 |
| anubis | 117 | 100 | 2026-10-28 |
| payoutsking | 117 | 0 | 2026-10-01 |
| toufan | 117 | 0 | 2023-12-27 |
| eldorado | 112 | 0 | 2025-01-22 |
| deadlock | 109 | 36 | |
| medusalocker | 103 | 0 | 2026-10-05 |
| threeam | 100 | 0 | 2026-10-09 |
| braincipher | 98 | 94 | 2026-07-22 |
| settra | 98 | 0 | 2026-09-25 |
| chaos | 97 | 187 | 2026-10-09 |
| abyss | 91 | 53 | 2026-08-26 |
| storm | 89 | 0 | |
| ransomexx | 86 | 11 | 2026-06-20 |
| payload | 83 | 89 | 2026-10-08 |
| auditteam | 65 | 42 | 2026-08-27 |
| emperador | 59 | 67 | |
| metaencryptor | 57 | 85 | 2026-10-12 |
| aurora | 56 | 59 | 2026-10-30 |
| orova | 56 | 0 | |
| termite | 55 | 49 | 2026-10-09 |
| booba project | 54 | 16 | |
| global secret group | 54 | 54 | |
| gunra | 54 | 0 | 2026-09-04 |
| insomnia | 53 | 48 | 2026-09-17 |
| ailock | 51 | 61 | 2026-08-26 |
| blacknevas | 48 | 1 | 2026-09-17 |
| wallstreet | 47 | 1 | |
| panzer | 46 | 0 | |
| m3rx | 44 | 44 | 2026-09-29 |
| cmdorganization | 43 | 3 | 2026-07-31 |
| embargo | 41 | 17 | 2026-09-09 |
| j | 41 | 0 | 2025-11-01 |
| global | 38 | 10 | 2026-09-12 |
| crpxo | 37 | 0 | |
| dark project | 36 | 30 | |
| moneymessage | 36 | 0 | 2026-09-21 |
| bravox | 34 | 0 | 2026-10-16 |
| dan0n | 33 | 0 | 2024-08-23 |
| alphalocker | 31 | 2 | 2026-02-28 |
| majinahanashi | 30 | 0 | |
| fulcrumsec | 29 | 29 | 2026-09-11 |
| l group | 28 | 0 | |
| titan | 26 | 26 | 2026-09-22 |
| werewolves | 26 | 0 | 2024-03-04 |
| zawoo | 25 | 0 | |
| morpheus | 24 | 0 | 2026-10-01 |
| vexy ransomware | 23 | 23 | |
| daixin | 21 | 53 | 2025-09-11 |
| shadowbyt3$ | 21 | 23 | 2026-08-29 |
| eclipse | 20 | 10 | |
| kazu | 20 | 0 | 2026-09-07 |
| doommageddon | 19 | 19 | |
| ralord | 19 | 2 | 2025-04-27 |
| alp-001 | 17 | 0 | 2026-04-08 |
| helix | 17 | 17 | |
| whitearmor | 17 | 0 | |
| iah6477 | 16 | 16 | 2026-10-15 |
| barracuda | 15 | 2 | |
| exfilsquad | 15 | 18 | |
| black x | 14 | 0 | |
| orion | 14 | 21 | 2026-07-27 |
| blackout | 12 | 0 | 2026-07-19 |
| icarus | 12 | 0 | 2026-06-23 |
| imncrew | 12 | 0 | 2025-09-16 |
| dysphor1a | 11 | 0 | |
| hyflock | 11 | 0 | |
| byod | 10 | 0 | |
| netrunner | 10 | 14 | 2026-10-08 |
| umbra | 10 | 0 | |
| leakbazaar | 9 | 0 | 2026-05-09 |
| scarlettgroup | 9 | 0 | |
| redact | 8 | 8 | |
| the seven deadly sins | 8 | 8 | |
| ulose | 8 | 0 | |
| vanhelsing | 8 | 0 | 2025-04-05 |
| 0mega | 7 | 0 | 2024-01-25 |
| gammax | 7 | 9 | |
| karma | 7 | 0 | 2021-10-04 |
| malekteam | 7 | 0 | 2024-04-05 |
| runsomewares | 7 | 11 | 2025-07-10 |
| secp0 | 7 | 7 | 2026-09-22 |
| vypr | 7 | 0 | |
| endzone | 6 | 501 | |
| falcon | 6 | 4 | |
| 0day syndicate | 5 | 0 | |
| everstake | 5 | 0 | |
| exitium | 5 | 9 | 2026-10-10 |
| gdlockersec | 5 | 0 | 2025-01-26 |
| ms13089 | 5 | 9 | 2026-08-15 |
| prinzeugen | 5 | 1 | 2026-06-04 |
| spirals | 5 | 6 | |
| valencialeaks | 5 | 0 | 2024-09-18 |
| satanlockv2 | 4 | 0 | 2025-07-07 |
| shiba | 4 | 0 | |
| triple x | 4 | 0 | |
| blacklocks | 3 | 0 | |
| d1r | 3 | 0 | |
| ethics | 3 | 0 | |
| rebornvc | 3 | 0 | 2025-07-09 |
| timc | 3 | 0 | 2026-04-09 |
| blackfield | 2 | 0 | |
| bluewhale | 2 | 0 | |
| imnotavillain | 2 | 1 | |
| mimori | 2 | 0 | |
| sensayq | 2 | 0 | 2024-06-04 |
| the green blood group | 2 | 0 | |
| loki | 1 | 0 | 2026-03-12 |
| notpetya | 1 | 0 | |
| robinhood | 1 | 0 | 2021-12-06 |
| sovcali | 1 | 0 | |
| abrahams_ax | 0 | 0 | |
| agl0bgvycg | 0 | 0 | |
| aptlock | 0 | 0 | |
| bolt team | 0 | 0 | |
| contfr | 0 | 0 | 2026-04-22 |
| cyberleek | 0 | 0 | |
| darkmatter | 0 | 0 | |
| galago | 0 | 0 | |
| goddamn ransomwhere | 0 | 0 | |
| lockbit3_fs | 0 | 204 | 2026-04-22 |
| meowciety403 | 0 | 12 | |
| montage | 0 | 0 | |
| payday | 0 | 0 | |
| section9 | 0 | 0 |
groups.csv
| Column | Meaning |
|---|---|
group |
Canonical lowercase name |
active |
Whether our crawler could reach a leak site recently — not whether the group has disbanded |
first_seen, last_seen |
Activity window |
victim_count |
Total claimed victims (aggregated) |
first_party_victims |
Victims we read off this group's own site |
mirrors_up |
Onion addresses that answered on the last probe |
screenshot_url |
Our own capture of the leak site front page, face-blurred |
Every group has a page at https://threatcluster.io/dark-web/group/{group} and every victim at
https://threatcluster.io/dark-web/victim/{slug}.
onions.csv
| Column | Meaning |
|---|---|
onion_url |
The address |
kind |
leak_site (actively monitored) or an archived category (market, forum, …) |
operator |
Group / site name where known |
reachability |
up / down from our own probe; blank means archived and no longer probed |
last_checked |
When we last probed it |
This is a directory of criminal infrastructure published for research, blocking and monitoring — the same basis on which other public trackers publish theirs. Addresses are ones the operators advertise themselves; nothing here is a credential or an access route.
- Claims, not confirmations. A listing means a group said it breached an organisation.
- Names are as the group wrote them, including typos and stylisation. Match on
websitewhere present rather than onvictim. - Claimed sizes are verbatim in the API record.
0.00 GBalongside a large file count is the group's page being wrong, faithfully recorded; we don't correct it. - Screenshots are ours — captured by our crawler with faces blurred. No third-party images are redistributed.
Listed in error, or an organisation that wants its entry reviewed: hello@threatcluster.io.
- Browse: threatcluster.io/dark-web · all groups · recent victims
- IOC feeds (domains, IPs, hashes, wallets): Public-Feeds-IOCs
- API quick start: threatcluster.io/api · leak-site endpoints · client and examples: Cyber-Threat-Intelligence-API